CVE-2021-36386: High severity fetchmail vulnerability
reportvbuild in report.c in Fetchmail before 6.4.20 sometimes omits initialization of the vsnprintf valist argument, which might allow mail servers to cause a denial of service or possibly have unspecified other impact via long error messages. NOTE: it is unclear whether use of Fetchmail on any realistic platform results in an impact beyond an inconvenience to the client user.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2021-36386?
CVE-2021-36386 has a medium severity due to the potential for denial of service caused by uninitialized variables.
How do I fix CVE-2021-36386?
To fix CVE-2021-36386, upgrade Fetchmail to version 6.4.20 or later.
Which versions of Fetchmail are affected by CVE-2021-36386?
Fetchmail versions before 6.4.20 are affected by CVE-2021-36386.
Can CVE-2021-36386 lead to data loss?
CVE-2021-36386 may introduce a denial of service but does not directly indicate a risk of data loss.
What systems are impacted by CVE-2021-36386?
CVE-2021-36386 impacts systems using Fetchmail prior to version 6.4.20 and certain versions of Fedora such as 33 and 34.